Tatu Ylonen @tjssh

Cybersecurity expert. Inventor of SSH - Secure Shell. Artificial intelligence, machine learning, linguistics, knowledge representation. 30+ US patents. ylonen.org Helsinki, Finland Joined December 2009

Tweets

825
Followers

7K
Following

5K
Likes

5K

Tatu Ylonen @tjssh

4 years ago

I'm leaving this New Twitter. It was once a useful platform.

9 1 29 9K 0

View Details

Tatu Ylonen @tjssh

6 years ago

I'll be talking with Sam Curry tomorrow in the webinar on the Future of Security. You are welcome to join! Please register at: attendee.gotowebinar.com/register/69146…

0 0 10 0 0

View Details

Tatu Ylonen @tjssh

7 years ago

@antti_antinoja Even Linux sort is using 74GB to sort a trivial 78GB text file.

2 0 1 0 0

View Details

Tatu Ylonen @tjssh

7 years ago

When did it start to feel normal to run 50-150GB processes every few minutes?

1 2 36 0 1

View Details

Tatu Ylonen @tjssh

8 years ago

@Icelandair I am unhappy with your recent obfuscation of pricing and reduction of economy baggage allowance. Your wifi usually does not work. And if you think I'll pay $5-9k for your premium economy style Saga class seats, you must be out of your minds. I'm a Saga gold member.

1 0 1 0 0

View Details

Tatu Ylonen @tjssh

8 years ago

@TorstenBlum @bsdunix4ever @dersharky Sorry I've been away from twitter so very late answer... I think I tried to use same flags as used by rcp on systems I used... might be BSD at that time, not sure.

0 0 2 0 0

View Details

CRN @CRN

8 years ago

#Intel pledges more fixes against #Spectre And #Meltdown. Here's what you need to know about the latest updates:

0 5 5 0 0

View Details

CRN @CRN

8 years ago

Is it time to regulate #IoT devices? We talk to #cybersecurity experts @samjcurry and @tjssh about the rising threats of smart devices.

0 6 5 0 1

View Details

SSH - Defensive Cybersecurity @SSH

8 years ago

Want to see how future of Cloud Access for #DevOps? Visit @SSH booth in @CloudExpoEurope Stand: S2248 #CSE18 #security

0 2 4 0 0

View Details

Tatu Ylonen @tjssh

8 years ago

SSH.COM & ISACA: SSH (Secure Shell) Practitioner guidelines. info.ssh.com/ssh_practition… #grc #infosec #isaca

0 6 16 0 0

View Details

Tatu Ylonen @tjssh

9 years ago

ISACA: SSH Practitioner guidelines. info.ssh.com/ssh_practition… #grc #infosec #isaca

0 10 7 0 1

View Details

Tatu Ylonen @tjssh

9 years ago

@io_r_us My current understanding is that the Meltdown attack is due to speculative execution affecting caches even when access is not permitted. HW flaw. Spectre is trickier, speculative execution affecting caches on branch prediction miss. I'm not yet sure how to universally solve it.

0 0 0 0 0

View Details

Tatu Ylonen @tjssh

9 years ago

@io_r_us It's been 15-20 years since I last wrote DMA device drivers, but my understanding is that the OS will usually map the (user/kernel) buffer to physical addresses before passing them to the DMA controller. (I'm not up to date on this)

1 0 1 0 0

View Details

Tatu Ylonen @tjssh

9 years ago

@io_r_us My understanding is that DMA usually works with real addresses (not virtual addresses) and can access all memory anyway. There are well-known attacks via PCI bus, firewire etc that utilize DMA. They can read & write kernel data&code, unlock screen saver, and take full control.

1 0 0 0 0

View Details

Tatu Ylonen @tjssh

9 years ago

It looks like the Intel attacks seriously affect end user systems as well and are remotely exploitable (Javascript, flash/client-side Java?). Can be injected to any unencrypted HTTP connection on the network or by corrupt server. Browser dependent. Email? spectreattack.com/spectre.pdf

1 10 9 0 0

View Details

Tatu Ylonen @tjssh

9 years ago

@MalinaKirn Looks like you are right. This will be bad. Apparently the Javascript exploit might be used to read memory of the entire process. This could potentially be used to read passwords, secret keys, cookies, and other sensitive data for other sites (if all tabs in same process).

0 0 0 0 0

View Details

Tatu Ylonen @tjssh

9 years ago

@philchungny I'm not quite sure what you mean by bare metal cloud server without hypervisor. Presumably there is a provisioning system that accepts connections and commands (e.g., migrate, shutdown, configure). It authenticates the connection. Usually there is a credential or key to read.

1 0 0 0 0

View Details

Tatu Ylonen @tjssh

9 years ago

@CyberPlayGround If the attack works as I (and some other people) speculate, I think it is difficult to exploit from Java (or Javascript) VMs. I could be wrong. In any case, client-side Java (or flash) in browsers is getting rare/deprecated. Javascript exploit would be unpleasant.

0 0 0 0 0

View Details

Tatu Ylonen @tjssh

9 years ago

@io_r_us I hope the Russian specialist is right and its not affecting cloud hypervisors... I'm rather concerned it might be used to, e.g., read SSH keys from kernel I/O buffers from VMs, and therefore gain access to other VMs and possibly even the hypervisor. But details are scarce.

1 0 1 0 0

View Details

Tatu Ylonen @tjssh

9 years ago

The Intel speculative execution flaw appears serious and multiuser systems (especially public cloud hypervisors) MUST be patched quickly. End user systems and appliances appear largely unaffected (single user). Not remotely exploitable. Performance penalty from fix 5-30% or so.